Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Rockliffe Mailsite User Enumeration Flaw
From: Josh Zlatin <jzlatin () ramat cc>
Date: Wed, 4 Jan 2006 10:05:03 -0500 (EST)

Synopsis: Rockliffe's Mailsite Mail Management Server User Enumeration Flaw.

Product: Rockliffe Mailsite

Version: Confirmed on Mailsite <=

Author: Josh Zlatin-Amishav

Date: January 4, 2006

Rockliffe MailSite secure email server software and MailSite MP secure email
gateways provide email server solutions and gateway email protection for businesses and service providers. Rockliffe has more than 3,000 customers hosting more than 15 million mailboxes worldwide.

In working with researchers at Tenable Network Security, I have come across
a user enumeration flaw in the Mail Management Agent (MAILMA). The server responds differently depending on whether the user account exists. This affords an attacker a means of brute forcing passwords and an effective means to cultivate valid email addresses for spam.


josh () maoz:~$ telnet 106
Connected to (
Escape character is '^]'.
200 Ok, "MailSite Mail Management Server ( ready" user IDoNotExist
510 "Error 2 in OpenMailbox, The system cannot find the file specified. "
user postmaster
200 Ok, "send password"

In addition the MailMA service does not block / throttle connection attempts, or close a user account after a given number of unsuccessful attempts.

Vendor notified: January 3, 2006 06:12AM

Vendor Response:
Contact your sales rep about purchasing Mailsite (note version is also vulnerable to this issue)

None at this time.

References: http://www.rockliffe.com
References: http://zur.homelinux.com/Advisories/RockliffeMailsiteUserEnum.txt
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • Rockliffe Mailsite User Enumeration Flaw Josh Zlatin (Jan 04)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]